Detection and service security mechanism of XML injection attacks

Abstract

The paper studies two classical XML injection attacks, structure-altering XML injection attack and parameter-error XML injection attack. For XML injection attacks, the paper proposes a detection method based on SOAP message verification tree. For the characteristics of parameter-error XML injection attack, the paper proposes a method that detects if there are nodes with the same name under a node of SOAP messages. Simulation results indicate that two detection schemes proposed in the paper is effective. © Springer-Verlag Berlin Heidelberg 2013.